From a458c3871c2d0ce05824ecb140bb62aec2faa3ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Tue, 1 Sep 2026 16:19:27 +0200 Subject: [PATCH 1/2] dockerd: Document `default-stop-timeout` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Paweł Gronowski --- docs/reference/dockerd.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/reference/dockerd.md b/docs/reference/dockerd.md index 1dcb19162654..71cb56212b14 100644 --- a/docs/reference/dockerd.md +++ b/docs/reference/dockerd.md @@ -51,6 +51,7 @@ Options: --default-network-opt mapmap Default network options (default map[]) --default-runtime string Default OCI runtime for containers (default "runc") --default-shm-size bytes Default shm size for containers (default 64MiB) + --default-stop-timeout int Set the default container stop timeout in seconds (0 to terminate immediately) (default 10) --default-ulimit ulimit Default ulimits for containers (default []) --dns list DNS server to use --dns-opt list DNS options to use @@ -758,6 +759,18 @@ This only adds the proxy and authentication to the Docker daemon's requests. To use the proxy when building images and running containers, see [Configure Docker to use a proxy server](https://docs.docker.com/engine/cli/proxy/) +### Default container stop timeout + +The `--default-stop-timeout` flag sets the number of seconds to wait for a +container to stop when the container doesn't have a `--stop-timeout` configured. +The default is `10` seconds on Linux and `30` seconds on Windows. A value of `0` +doesn't wait before forcefully terminating the container. Negative values are +invalid. + +You can also configure the timeout with the `default-stop-timeout` option in the +[daemon configuration file](#daemon-configuration-file). You can reload this +option without restarting the daemon. + ### Default `ulimit` settings The `--default-ulimit` flag lets you set the default `ulimit` options to use for @@ -1104,6 +1117,7 @@ The following is a full example of the allowed configuration options on Linux: "default-network-opts": {}, "default-runtime": "runc", "default-shm-size": "64M", + "default-stop-timeout": 10, "default-ulimits": { "nofile": { "Hard": 64000, @@ -1225,6 +1239,7 @@ The following is a full example of the allowed configuration options on Windows: "debug": true, "default-network-opts": {}, "default-runtime": "", + "default-stop-timeout": 30, "default-ulimits": {}, "dns": [], "dns-opts": [], @@ -1317,6 +1332,7 @@ The list of currently supported options that can be reconfigured is this: | `max-concurrent-uploads` | Configures the max concurrent uploads for each push. | | `max-download-attempts` | Configures the max download attempts for each pull. | | `default-runtime` | Configures the runtime to be used if not is specified at container creation. | +| `default-stop-timeout` | Configures the timeout for stopping containers that have no container-specific timeout. | | `runtimes` | Configures the list of available OCI runtimes that can be used to run containers. | | `authorization-plugin` | Specifies the authorization plugins to use. | | `insecure-registries` | Specifies a list of registries that the daemon should consider insecure. | From 7b7eb0ef6b0cb935e0e3b59474644c302cb73596 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Tue, 1 Sep 2026 16:33:04 +0200 Subject: [PATCH 2/2] dockerd: Document custom AppArmor profiles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Paweł Gronowski --- docs/reference/dockerd.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/docs/reference/dockerd.md b/docs/reference/dockerd.md index 71cb56212b14..61a342c655f4 100644 --- a/docs/reference/dockerd.md +++ b/docs/reference/dockerd.md @@ -25,6 +25,7 @@ A self-sufficient runtime for containers. Options: --add-runtime runtime Register an additional OCI compatible runtime (default []) --allow-direct-routing Allow remote access to published ports on container IP addresses + --apparmor-profile string Path to AppArmor profile template --authorization-plugin list Authorization plugins to load --bip string IPv4 address for the default bridge --bip6 string IPv6 address for the default bridge @@ -806,6 +807,24 @@ allow the request for it to complete. For information about how to create an authorization plugin, refer to the [authorization plugin](https://docs.docker.com/engine/extend/plugins_authorization/) section. +### Configure the default AppArmor profile + +The `--apparmor-profile` option sets the path to an AppArmor profile definition +for Docker's default `docker-default` container profile. This option is only +supported on Linux hosts. The file can be a static profile or a Go template. + +The equivalent `daemon.json` configuration is: + +```json +{ + "apparmor-profile": "/etc/docker/apparmor/docker-default" +} +``` + +Restart the daemon to apply changes. For template values, safe file placement, +security considerations, and verification, see +[Customize the default AppArmor profile](https://docs.docker.com/engine/security/apparmor/#customize-the-default-profile). + ### Daemon user namespace options The Linux kernel @@ -1079,6 +1098,7 @@ The following is a full example of the allowed configuration options on Linux: ```json { "allow-direct-routing": false, + "apparmor-profile": "", "authorization-plugins": [], "bip": "", "bip6": "",